Something went wrong. Try again.
This repository has no description
Something went wrong. Try again.
JavaScript
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176import * as Effect from "effect/Effect";import assert from "node:assert/strict";import { test } from "node:test";import { Secret } from "../configuration/secrets.ts";import { createOwnerSession } from "../worker/session.ts";import { updateOnOwnerVisit } from "../worker/update-on-visit.ts";
const oldDigest = "1".repeat(64);const newDigest = "2".repeat(64);const installation = { installationId: "0123456789abcdef0123456789abcdef", ownerSubject: "owner-subject", runtimeOrigin: "https://runtime.example", controlPlaneOrigin: "https://publisher.example", bridge: { keyId: "publisher-key", publicKey: "unused-here" }, release: { version: "1.0.0", sourceRevision: "a".repeat(40), artifactDigest: oldDigest, },};const secret = new Secret("owner-session-test-secret-at-least-32-bytes");const latest = { version: "1.1.0", sourceRevision: "b".repeat(40), artifactDigest: newDigest,};const response = (body = latest, init = {}) => new Response(typeof body === "string" ? body : JSON.stringify(body), { headers: { "Content-Type": "application/json", ...init.headers }, ...init, });
async function ownerRequest(path = "/chat", options = {}) { const cookie = ( await Effect.runPromise(createOwnerSession(secret, installation)) ).split(";", 1)[0]; return new Request(installation.runtimeOrigin + path, { headers: { Accept: "text/html", "Sec-Fetch-Dest": "document", Cookie: cookie, ...options.headers, }, method: options.method, });}
test("only an authenticated owner navigation to an outdated release redirects", async () => { let calls = 0; const network = async (url, init) => { calls++; assert.equal(url.href, "https://publisher.example/api/releases/latest"); assert.equal(init.redirect, "manual"); return response(); }; assert.equal( await Effect.runPromise( updateOnOwnerVisit( new Request(installation.runtimeOrigin, { headers: { Accept: "text/html" }, }), installation, secret, true, network, ), ), null, ); const redirect = await Effect.runPromise( updateOnOwnerVisit( await ownerRequest(), installation, secret, true, network, ), ); assert.equal(redirect?.status, 303); assert.equal( redirect?.headers.get("location"), `https://publisher.example/connect?updateInstallation=${installation.installationId}`, ); assert.equal(redirect?.headers.get("cache-control"), "no-store"); assert.equal(calls, 1);});
test("current release and excluded requests neither redirect nor contact publisher", async () => { const current = async () => response({ ...latest, artifactDigest: oldDigest }); assert.equal( await Effect.runPromise( updateOnOwnerVisit( await ownerRequest(), installation, secret, true, current, ), ), null, ); const excluded = [ ["/api/messages", {}], ["/flarebot-health.txt", {}], ["/auth/login", {}], ["/agents/one", {}], ["/asset.js", { headers: { "Sec-Fetch-Dest": "script", Accept: "*/*" } }], ["/chat", { method: "POST" }], ["/chat", { headers: { Upgrade: "websocket" } }], ]; for (const [path, options] of excluded) { let called = false; const result = await Effect.runPromise( updateOnOwnerVisit( await ownerRequest(path, options), installation, secret, true, async () => { called = true; return response(); }, ), ); assert.equal(result, null, path); assert.equal(called, false, path); }});
test("local mode is disabled and untrusted publisher replies fail safe", async () => { let called = false; assert.equal( await Effect.runPromise( updateOnOwnerVisit( await ownerRequest(), installation, secret, false, async () => { called = true; return response(); }, ), ), null, ); assert.equal(called, false); const replies = [ () => response("not-json"), () => response({ ...latest, artifactDigest: "javascript:bad" }), () => response("x".repeat(8193)), () => response(latest, { headers: { "Content-Length": "8193" } }), () => response("", { status: 302, headers: { Location: "https://evil.example/" }, }), () => response("no", { status: 503 }), ]; for (const reply of replies) assert.equal( await Effect.runPromise( updateOnOwnerVisit( await ownerRequest(), installation, secret, true, reply, ), ), null, );});